Affected Systems
D-Link DGS-3130-30TS Series managed Gigabit stackable switches, multiple firmware versions. Impact on other D-Link switching platforms under investigation. Primarily deployed in SMB and metro Ethernet environments.
Exploitation Status
No public PoC or active exploitation reported. Vulnerabilities disclosed by Spectrum Community Solutions researcher. CVE IDs not yet published. No patch available.
Business Impact
Attackers with network access can extract sensitive device data, modify configurations, leak SNMP community strings, or cause service disruptions and device resets via D-Link Discovery Protocol (DDP) flaws. Affects authentication, access control, and information handling. Impacts SMB and metro Ethernet deployments relying on these switches for multi-gigabit uplinks. No timeline provided for firmware patch release.
Urgency
🟠Within 24 hours
Recommended Actions
- Disable D-Link Discovery Protocol (DDP) on all DGS-3130 Series switches to eliminate primary attack vector
- Remove default and unnecessary SNMP community strings from affected devices
- Restrict SSH, web UI, and SNMP access to isolated management VLANs and designated admin hosts only
- Create and maintain offline configuration backups for rapid recovery from unauthorized changes
- Monitor device logs for unexpected configuration changes, unprompted reboots, or factory resets